CISRM study guide
CISRM · Work through your exam, one topic at a time.
The Certified Information Security Risk Manager (CISRM) is a vendor-neutral credential aimed at professionals who own or contribute to an organization's information security risk program. Typical candidates are risk managers, security managers and architects, GRC analysts, internal auditors, and consultants who need to move beyond checklist compliance and defend risk decisions to executives and boards. The CISRM study guide has 9 sections and about 2,730 words.
01Risk Management Fundamentals and Governance
Domain 1 tests how well you can explain risk language and governance before touching tools. Expect questions on risk appetite, tolerance, capacity, ownership, and the board's role.
344 words, about 2 min02Risk Identification and Asset Inventory
Domain 2 tests whether you can find risk before scoring it. The exam emphasizes asset inventories, classification, threat and vulnerability identification, and structured techniques.
303 words, about 2 min03Risk Analysis and Assessment Methodologies
Domain 3 tests selecting and applying analysis methods, not just reciting formulas. You need to know when qualitative, semi-quantitative, and quantitative methods fit.
318 words, about 2 min04Risk Evaluation and Prioritization
Domain 4 tests the judgment step after analysis: deciding which risks matter and in what order to act. Expect questions on appetite comparison, risk ranking, velocity, and aggregation.
301 words, about 2 min05Risk Treatment and Control Selection
Domain 5 tests how you choose and justify risk responses. The exam expects control categories, cost-benefit reasoning, and residual-risk acceptance.
302 words, about 2 min06Risk Monitoring, Reporting, and Communication
Domain 6 tests the feedback loop: keeping risk information current, measuring control performance, and communicating to the right audience. Monitoring tracks risk levels, treatment progress, control effectiveness, and changes in context.
295 words, about 1 min07Third-Party and Supply Chain Risk Management
Domain 7 tests the full vendor lifecycle and the extended supply chain, including fourth parties and concentration risk. Tier third parties by criticality, data access, and business dependency; due diligence depth should follow tier.
281 words, about 1 min08Compliance, Legal, and Regulatory Considerations
Domain 8 tests how legal and regulatory obligations interact with risk management. Expect questions on compliance as a baseline, cross-border data, and evidence.
292 words, about 1 min09Business Continuity and Incident Response Risk
Domain 9 tests recovery planning and incident response as risk treatments, with emphasis on business impact analysis and testing. A BIA identifies critical processes, dependencies, and maximum tolerable downtime (MTD).
294 words, about 1 min